WSO2 API Flaw Draws Conflicting Accounts as CISA Confirms Exploitation
CISA describes file upload and possible code execution; WSO2 describes a JWT bypass and account takeover. Check product builds and reconcile the attack path with WSO2.
An exploited flaw in WSO2’s API infrastructure has two sharply different descriptions under CVE-2026-5430. CISA’s exploited-vulnerability entry describes path traversal enabling unrestricted file upload and possible remote code execution. The WSO2-assigned CVE record describes faulty JWT validation that could give an attacker unauthorized access, including administrative account takeover. Both name four WSO2 products: API Control Plane, API Manager, Traffic Manager and Universal Gateway.
October 4, 2026: CISA added the flaw on September 24 and set September 27 as the federal action date. That date has passed, so WSO2 owners should inventory running builds now and arrange forensic triage of exposed installations. CISA marks ransomware-campaign use as unknown. The two records’ mechanism descriptions call for separate response questions rather than a single assumed exploit sequence.
JWT validation and file upload diverge
WSO2’s CVE record says, “The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported.” It says the resulting validation error could permit unauthorized access and account takeover. Its general CVSS score is 10.0; its description adjusts the score to 9.8 in a single-tenant deployment. Hacktron.ai is credited as the finder.
CISA instead calls this a path-traversal vulnerability that could allow unrestricted file upload and lead to code execution. Its KEV listing establishes known exploitation of this CVE, while the WSO2-authored record supplies the JWT mechanism and release boundaries. Ask WSO2 whether its release guidance covers both descriptions before considering a version match the entire response. Treat an exposed older deployment as a triage priority now.
WSO2 release thresholds by product
The WSO2-assigned affected-version list gives these first builds outside the listed affected ranges. Check the installed build of each deployed role, including separately operated gateways and traffic managers.
| Product | Affected branch | First build outside listed affected range |
|---|---|---|
| Universal Gateway | 4.5.0; 4.6.0 | 4.5.0.57; 4.6.0.21 |
| Traffic Manager | 4.5.0; 4.6.0 | 4.5.0.56; 4.6.0.21 |
| API Control Plane | 4.5.0; 4.6.0 | 4.5.0.58; 4.6.0.22 |
| API Manager | 4.1.0; 4.2.0; 4.3.0 | 4.1.0.257; 4.2.0.197; 4.3.0.108 |
| API Manager | 4.4.0; 4.5.0; 4.6.0 | 4.4.0.72; 4.5.0.57; 4.6.0.21 |
The record classifies API Manager versions earlier than 4.1.0 as unknown. It also lists affected versions of the org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util component: 9.20.74 below 9.20.74.401, 9.28.116 below 9.28.116.417, 9.29.120 below 9.29.120.236, 9.30.67 below 9.30.67.167, 9.31.86 below 9.31.86.158, and 9.32.147 below 9.32.147.59. The record marks 9.33.106 unaffected. Compare component versions when your deployment inventory tracks them separately.
Inventory builds and investigate exposure
CISA directs stakeholders to evaluate each asset’s internet exposure, apply vendor mitigations and perform forensic triage. Build an inventory of the four named WSO2 roles, their installed branch and build, and which interfaces accept internet traffic. Prioritize exposed systems below the applicable threshold for the vendor-directed update. Restrict unnecessary outside reachability to API administration and control interfaces as an interim access decision; assess public API routes separately for exposure.
For installations with relevant exposure, preserve access and authentication telemetry before changing the deployment. Review unexpected privileged API activity under WSO2’s JWT account-takeover description, and review file changes and upload activity under CISA’s file-upload description. Those are triage avenues tied to the published mechanisms, not CVE-specific detection signatures. Request WSO2’s current advisory and response guidance for your branch and ask which account explains the observed exploitation. CISA’s federal action date applies to covered agencies; other owners still have an exploited product to handle.
Map each API Control Plane, API Manager, Traffic Manager and Universal Gateway instance to its installed build and internet reachability; move affected branches to WSO2’s applicable release threshold while preserving telemetry for forensic triage. Seek vendor confirmation of the path-traversal account alongside the JWT account before deciding which historical activity needs deeper review. A clean build inventory answers what is running today; retained authentication and upload evidence is needed to investigate activity before the update.